The increased deployment of Internet of Things (IoT) devices will make them targets for attacks. IoT devices can also be used as tools for committing crimes. In this regard, we propose FIF-IoT - a forensic investigation framework using a public digital ledger to find facts in criminal incidents in IoT-based systems. FIF-IoT collects interactions that take place among various IoT entities (clouds, users, and IoT devices) as evidence and store them securely as transactions in a public, distributed and decentralized blockchain network which is similar to the Bitcoin network. Hence, FIF-IoT eliminates a single entity's control over the evidence storage, avoids single-point-offailure on the storage media, and ensures high availability of evidence. FIF-IoT presents a framework that ensures integrity, confidentiality, anonymity, and non-repudiation of the evidence stored in the public digital ledger. Furthermore, FIF-IoT provides a mechanism to acquire evidence from the ledger and to verify the integrity of the obtained evidence. We present a case study of a forensic investigation to demonstrate that FIF-IoT is secure against evidence tampering. We also implement a prototype to evaluate the performance of FIF-IoT.
The Internet of Things (IoT) has already reshaped and transformed our lives in many ways, ranging from how we communicate with people or manage our health to how we drive our cars and manage our homes. With the rapid development of the IoT ecosystem in a wide range of applications, IoT devices and data are going to be traded as commodities in the marketplace in the near future, similar to cloud services or physical objects. Developing such a trading platform has previously been identified as one of the key grand challenges in the integration of IoT and data science. Deployment of such a platform raises concerns about the security and privacy of data and devices since their ownership is hard to trace and manage without a central trusted authority. A central trusted authority is not a viable solution for a fully decentralized and distributed IoT ecosystem with a large number of distributed device vendors and consumers. Blockchain, as a decentralized system, removes the requirement for a trusted thirdparty by allowing participants to verify data correctness and ensure its immutability. IoT devices can use blockchain to register themselves and organize, store, and share streams of data effectively and reliably. We demonstrate the applicability of blockchain to IoT devices and data management with an aim of providing end-to-end trust for trading. We also give a brief introduction to the topics and challenges for future research toward developing a trustworthy trading platform for IoT ecosystems.
Gbadebo Ayoade, Vishal Karande, Latifur Khan, Kevin W. Hamlen
Due to the centralization of authority in the management of data generated by IoT devices, there is a lack of transparency in how user data is being shared among third party entities. With the popularity of adoption of blockchain technology, which provide decentralized management of assets such as currency as seen in Bitcoin, we propose a decentralized system of data management for IoT devices where all data access permission is en-forced using smart contracts and the audit trail of data access is stored in the blockchain. With smart contracts applications, multiple parties can specify rules to govern their interactions which is independently enforced in the blockchain without the need for a centralized system. We provide a framework that store the hash of the data in the blockchain and store the raw data in a secure storage platform using trusted execution environment (TEE). In particular, we consider Intel SGX as a part of TEE that ensure data security and privacy for sensitive part of the application (code and data).
Blockchain is one of the technology innovations for sharing data across organizations through a peer to peer overlay network. Many blockchain- based data sharing applications, such as sharing Electronic Health Records (EHRs) among different Care Delivery Organizations (CDOs), require privacy preserving verification services with dual capabilities. On one hand, the users want to verify the authenticity of EHR data as well as the identity of the signer. On the other hand, the signer wants to keep his real identity private such that others cannot trace and infer his identity information. However, typical blockchain systems that use pseudonyms as public keys, such as Bitcoin's blockchain, cannot support such privacy-preserving verification. In such systems, it is hard to verify the authenticity of signer's identity, and adversaries or curious parties can guess the real identity from the series of statements and actions taken with a specific pseudonym through inference attacks, such as by transaction graph analysis. In this paper, we propose a decentralized attribute- based signature scheme for healthcare blockchain, which provides efficient privacy-preserving verification of authenticity of EHR data and signer's identity. We also describe a holistic on-chain and off- chain collaborative storage system for efficient storage and verification EHR data. The analysis and experiments show that our scheme is effective and deployable.
The blockchain emerged as a novel distributed consensus scheme that allows transactions, and any other data, to be securely stored and verified without the need of any centralized authority. Distributed trust and therefore security and privacy are at the core of the blockchain technologies, and have the potential to either make them a success or cause them to fail. This special issue of IEEE Security & Privacy is an attempt to collect the most interesting ideas from the community of researchers and professionals working on blockchain security and privacy.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
With Bitcoin, the legitimacy of a block of transaction data is verified by randomly selected nodes (hereinafter, verifiers) and notified to all nodes. To ensure the random selection of the verifier of each block, Proof of Works (PoW) is used. However, there is a serious problem with PoW, in that the amount of computation becomes huge. Although Proof of Stake (PoS) has been proposed to reduce the amount of computation, there remains the problem that if there is collusion among nodes, it is possible to control the probability of being the verifier. In this paper, a novel technique, Proof-of-Lucky-ID (PoL), is proposed. PoL is a kind of lottery that guarantees the randomness of the selection of the verifier, even if the node is collaborating unfairly, by using multiple digital signatures created by other nodes as input. Since this technique can determine the verifier with about two hash calculations per node, it significantly reduces the amount of processing compared with PoW, which requires more than 10^19 hash calculations as of 2017. In addition, since the input value cannot be controlled even if there is node collusion, it is impossible to control the probability of a win. Furthermore, compared to PoW and PoS, the certainty of consensus can be estimated with high accuracy in a short time. Numerical calculations show that both the randomness of verifier selection by the proposed method and the accuracy of the certainty of consensus range estimation are sufficiently high.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Harsh Desai, Kevin Liu, Murat Kantarcıoğlu, Lalana Kagal
As more and more data is collected for various reasons, the sharing of such data becomes paramount to increasing its value. Many applications ranging from smart cities to personalized health care require individuals and organizations to share data at an unprecedented scale. Data sharing is crucial in today's world, but due to privacy reasons, security concerns and regulation issues, the conditions under which the sharing occurs needs to be carefully specified. Currently, this process is done by lawyers and requires the costly signing of legal agreements. In many cases, these data sharing agreements are hard to track, manage or enforce. In this work, we propose a novel alternative for tracking, managing and especially adjudicating such data sharing agreements using smart contracts and blockchain technology. We design a framework that generates smart contracts from parameters based on legal data sharing agreements. The terms in these agreements are automatically adjudicating by the system. Monetary punishment can be employed using secure voting by external auditors to hold the violators accountable. Our experimental evaluation shows that our proposed framework is efficient and low-cost.
Haneffa Muchlis Gazali, Che Muhamad Che Muhamad Hafiz Bin Che Hafiz Ismail, Tamrin Amboala
The explosion of virtual currency investment has hit the financial system and brought the cryptocurrency to the global spotlight in recent years. Hitherto, no research has yet systematically investigated the factors that influencing users' intention to invest in cryptocurrency. Thus, this study is aimed to develop an understanding regarding cryptocurrency investment by investigating the intention to invest in cryptocurrency; in this case is Bitcoin. This paper is a conceptual paper that extends the applicability of Theory of Reason Action (TRA) by incorporating perceived risk and perceived benefits as the additional variables from cryptocurrency investment context. Being limited to conceptual evidence, this study lacks the empirical evidence. Future works are needed to be done to establish the empirical support on the association of the studied variables.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
The Internet of Things (IoT) is a name coined to the digital ecosystem of numerous internet connected devices. It brings the physical world closer to the digital one and as a result, allows for new applications and services. The emergence of Blockchain, a distributed ledger technology, presents a possible solution to ensure trust in decentralized systems. Blockchain brings trust, immutability, and verifiability of a distributed ledger in a decentralized network which could be useful to build trust in IoT. However, the integration of IoT with Blockchain involves a number of challenges. The use of Blockchain within the IoT is a recent and a fast paced topic. Therefore, conducting a systematic literature review is essential to understand what has been proposed on the topic. Recent work has provided a systematic review with a focus on Bitcoin. In this paper, we present a systematic review of more recent work on Blockchain and IoT, with a broader focus on Blockchain platforms beyond Bitcoin. Our work provides an overview of what has been done so far on the use of Blockchain and IoT.
Sara Rouhani, Luke Butterworth, Adam D. Simmons, Darryl G. Humphery · 5 authors
The set of distributed ledger architectures known as blockchain is best known for cryptocurrency applications such as Bitcoin and Ethereum. These permissionless block chains are showing the potential to be disruptive to the financial services industry. Their broader adoption is likely to be limited by the maximum block size, the cost of the Proof of Work consensus mechanism, and the increasing size of any given chain overwhelming most of the participating nodes. These factors have led to many cryptocurrency blockchains to become centralized in the nodes with enough computing power and storage to be a dominant miner and validator. Permissioned chains operate in trusted environments and can, therefore, avoid the computationally expensive consensus mechanisms. Permissioned chains are still susceptible to asset storage demands and non-standard user interfaces that will impede their adoption. This paper describes an approach to addressing these limitations: permissioned blockchain that uses off-chain storage of the data assets and this is accessed through a standard browser and mobile app. The implementation in the Hyperledger framework is described as is an example use of patient-centered health data management.
Uchi Ugobame Uchibeke, Kevin A. Schneider, Sara Hosseinzadeh Kassani, Ralph Deters
In recent years, the advancement in modern technologies has not only resulted in an explosion of huge data sets being captured and recorded in different fields, but also given rise to concerns in the security and protection of data during storage, transmission, processing, and access. The blockchain is a distributed ledger that records transactions in a secure, flexible, verifiable and permanent way. Transactions in a blockchain can be an exchange of an asset, the execution of the terms of a smart contract, or an update to a record. In this paper, we have developed a blockchain access control ecosystem that gives asset owners the sovereign right to effectively manage access control of large data sets and protect against data breaches. The Linux Foundation's Hyperledger Fabric blockchain is used to run the business network while the Hyperledger composer modeling tool is used to implement the smart contracts or transaction processing functions that run on the blockchain network.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
A review system is a valuable component in E-commerce applications. Existing centralized review systems are prone to review frauds and manipulations. A decentralized, immutable and auditable blockchain system is a natural fit to prevent fraudulent and manipulated reviews. We develop and implement ReviewChain, a decentralized review system using Ethereum smart contract. ReviewChain validates new reviews by querying the identity of purchasers from a supply chain system. We assume that the supply chain system is based on blockchain technology. We develop and implement a mechanism to tie two disparate Ethereum based blockchain networks. Ethereum smart contract code is limited and cannot make external procedure calls. Therefore, we introduce multi-blockchain gateway nodes called notaries. Our proposed smart contracts and notaries allow us to interface two blockchains effectively. We run ReviewChain and discuss how various design parameters impact the system performance.
The anonymous and decentralized nature of cryptocurrencies has turned them into a powerful weapon in the cyberarsenal of national and international criminal groups by facilitating their illicit activities while evading prosecution. However, despite the numerous challenges that the international law enforcement community faces when investigating cryptocurrencies, a number of investigation opportunities do exist.
Digital currencies such as Bitcoin rely on cryptographic primitives to operate. However, past experience shows that cryptographic primitives do not last forever: increased computational power and advanced cryptanalysis cause primitives to break and motivate the development of new ones. It is therefore crucial for maintaining trust in a cryptocurrency to anticipate such breakage. We present the first systematic analysis of the effect of broken primitives on Bitcoin. We analyze the ways in which Bitcoin’s core cryptographic building blocks can break and the subsequent effect on the main Bitcoin security guarantees. Our analysis reveals a wide range of possible effects depending on the primitive and type of breakage, ranging from minor privacy violations to a complete breakdown of the currency. Our results lead to several suggestions for the Bitcoin migration plans and insights for other cryptocurrencies in case of broken or weakened cryptographic primitives.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Kentaroh Toyoda, Tomoaki Ohtsuki, P. Takis Mathiopoulos
In recent years, Bitcoin has been used for many services and purposes, e.g. gambling, marketplace, but also even as an investment scam. In order to clarify how Bitcoin is used, it is in great importance to identify what kind of services are operated by Bitcoin addresses. In this paper, we propose a multiclass service identification scheme in Bitcoin based on novel transaction history summarization. Our novelty is to propose how transaction history is retrieved and how the retrieved transactions are processed for better identification. When a Bitcoin address is given, the characteristics of its transaction history is calculated as features. Then, the set of calculated features is fed into a supervised classifier and the services operated by the given Bitcoin addresses are identified among seven major services: (i) exchange, (ii) faucet, (iii) gambling, (iv) investment scam, (v) marketplace, (vi) mining pool, and (vii) mixer. To our knowledge, we are the first to propose a multi-class identification. We show that our scheme achieves 72 % of accuracy through performance evaluation with more than 26,000 Bitcoin addresses that have been used for seven services/purposes from Jan. 2009 to Feb. 2017.
The existing identity authentication of IoT devices mostly depends on an intermediary institution, i.e., a CA server, which suffers from the single-point-failure attack. Even worse, the critical data of authenticated devices can be tampered by inner attacks without being identified. To address these issues, we utilize blockchain technology, which serves as a secure tamper-proof distributed ledger to IoT devices. In the proposed method, we assign a unique ID for each individual device and record them into the blockchain, so that they can authenticate each other without a central authority. We also design a data protection mechanism by hashing significant data (i.e. firmware) into the blockchain where any state changes of the data can be detected immediately. Finally, we implement a prototype based on an open source blockchain platform Hyperledger Fabric to verify the proposed system.
Blockchain Technology Applications and Security
User Authentication and Security Systems
Advanced Steganography and Watermarking Techniques
Deepak K. Tosh, Sachin Shetty, Peter Foytik, Charles Kamhoua · 5 authors
Maintaining data provenance in cloud in a tamper-resistant manner that cannot be breached by malicious parties is a necessity from the current security standpoint. Blockchain technology has emerged as a secure solution to store and share information by offering an immutable distributed ledger service. Its effectiveness hinges on the infrastructure supporting the distributed ledger and consensus protocol that governs the validity of entries in the Blockchain. Hence, Blockchain can be a potential candidate to implement data provenance; however, traditional cryptocurrency-based consensus models become a bottleneck in the cloud environment. Therefore, in this paper, we propose a Blockchain based data provenance architecture (BlockCloud) that incorporates a proof-of-stake (PoS)-based consensus protocol (CloudPoS) for securely recording the data operations occurring in cloud environment. The critical operational phases of the protocol are discussed in depth, which leverages the cloud users' cyber infrastructure resources. A cloud-based testbed environment is created using a local cluster of physical machines managed by Xen hypervisor. Resource elasticity is enabled using Kubernetes setup that interacts with the dockerized containers, which emulate as peers in the Blockchain network. We then evaluate the effectiveness of the protocol in a simulated environment and conduct performance tests of the proposed consensus.
Trading commercial property currently involves several middlemen who are extra time-consuming and cost-consuming elements in a transaction. With recent blockchain-based smart contract innovations, it is possible to use distributed applications (Dapps) for disintermediating third parties and enabling direct peer-to-peer (P2P) transactions. The blockchain serves as an immutable, event-recording ledger that facilitates trust-less P2P transactions. The Evareium system is a distributed application for enabling blockchain-based commercial-property trades that make middlemen superfluous and consequently, investors benefit from cost reductions, faster transaction times, greater transparency and reduced regulatory burdens. As a consequence of the Evareium system, investors and other stake-holders are able to avail a direct interface with the creation and dissemination of optimal financial gains from such investments without interdiction. The corresponding Evareium token is structured for governing platform-related incentives. The Evareium token is also intended for Internet-of-Things (IoT) based hotelmanagement services such as controlling hotel-room blindfolds, A/C, smart keys, checkin, spa, restaurant, room service, and so on.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Blockchain based supply chain systems benefit from immutability and auditability properties. We develop and implement a blockchain based supply chain system in Ethereum platform. We find and address several challenges both in system design and performance issues. We focus on system design for transaction validation, information retrieval efficiency and fault-tolerant query mechanism. We describe our implementation details to bypass some of the limitations in Ethereum and smart contracts. We design a smart contract to efficiently organize miners' local data structure for transaction validation and information retrieval. We design Ethereum smart contract that allows transaction validation based on a priori knowledge of product life cycle. Our system achieves constant time latency per query independent of the blockchain length. We also consider supply chain systems with malicious miners that respond with false data upon query. We develop a sampling query and majority voting method accordingly. We evaluate our system's performance in emulated setting and show that even with 30% malicious miners, we still achieve reasonable accuracy in only 0.0723 seconds response time on average.
In the future, ecosystems for managing travel and all the associated services will be more diverse and innovative. These Mobility-as-a-Service (MaaS) ecosystems will combine services in an unforeseen way to enable fluent travel experiences. However, to succeed, MaaS ecosystems require integrators and enablers. Blockchains can serve as an technology enabler, but to reach their best potential blockchains need to tackle new business needs. MaaS ecosystems form an excellent arena for this. We present a model of a MaaS ecosystem, enabling easy, quick and trusted transactions taking advantage of artificial intelligence and blockchain-enabled smart contracts. We also present a subset demonstration of this model, TravelToken, which utilizes QR code that stores and uses travel information in smart contract over Ethereum. The benefits are that all travel data can be stored in one ticket, information stays unaltered in blockchain, and value-share as well as compensations in case of delays will be automatic.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Yiyun Zhou, Meng Han, Liyuan Liu, Yan Wang · 6 authors
The Internet of Things (IoT) global market is growing significantly fast in recent years, from a wearable small watch to a giant airplane. The Smart-home is one of the most popular applications which can improve the resident's life quality. However, the security and privacy issues of homeowner bring emerging challenges while more and more data are collecting and sharing by the instances of different IoT devices within the Smart-home. Confront the challenge, an emerging charming technology blockchain provides a private, secure, and decentralized mechanism for the data usage. But, there are still many challenges for the application of blockchain such as the efficiency, storage, and energy cost, etc. This paper proposes IoT architecture in Smart-home environment based on blockchain and smart contract with the comprehensive consideration of the primary challenges. Our approach exemplifies the three core components in Smart-home: smart contract, private blockchain, and public blockchain. Each Smart-home contains their unique private chain. We present the application scenarios in our architecture and discuss the principles of blockchain smart contract application for Smart-home.
Aurelio F. Bariviera, Luciano Zunino, Osvaldo A. Rosso
This paper discusses the dynamics of intraday prices of twelve cryptocurrencies during last months' boom and bust. The importance of this study lies on the extended coverage of the cryptoworld, accounting for more than 90\% of the total daily turnover. By using the complexity-entropy causality plane, we could discriminate three different dynamics in the data set. Whereas most of the cryptocurrencies follow a similar pattern, there are two currencies (ETC and ETH) that exhibit a more persistent stochastic dynamics, and two other currencies (DASH and XEM) whose behavior is closer to a random walk. Consequently, similar financial assets, using blockchain technology, are differentiated by market participants.
We design and implement the first private and anonymous decentralized crowdsourcing system ZebraLancer, and overcome two fundamental challenges of decentralizing crowdsourcing, i.e. data leakage and identity breach. First, our outsource-then-prove methodology resolves the tension between blockchain transparency and data confidentiality, which is critical in crowdsourcing use-case. ZebraLancer ensures: (i) a requester will not pay more than what data deserve, according to a policy announced when her task is published via the blockchain; (ii) each worker indeed gets a payment based on the policy, if he submits data to the blockchain; (iii) the above properties are realized not only without a central arbiter, but also without leaking the data to the open blockchain. Furthermore, the transparency of blockchain allows one to infer private information about workers and requesters through their participation history. On the other hand, allowing anonymity will enable a malicious worker to submit multiple times to reap rewards. ZebraLancer overcomes this problem by allowing anonymous requests/submissions without sacrificing the accountability. The idea behind is a subtle linkability: if a worker submits twice to a task, anyone can link the submissions, or else he stays anonymous and unlinkable across tasks. To realize this delicate linkability, we put forward a novel cryptographic concept, i.e. the common-prefix-linkable anonymous authentication. We remark the new anonymous authentication scheme might be of independent interest. Finally, we implement our protocol for a common image annotation task and deploy it in a test net of Ethereum. The experiment results show the applicability of our protocol with the existing real-world blockchain.